Create Payment
Charges a buyer for one or more variants with a payment method already on file (member_id and payment_method_id), or with a confirmation_token for a method the buyer just supplied. Collection runs in the background, so the response is the payment as created, not its outcome: poll Retrieve payment status for how far it has got and what the buyer must still do.
Authorizations
An Account API key, an App API key, an account access token, an account-scoped user token, or a user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************. See Auth & API keys for how to get each one.
Headers
A unique key that makes this request safe to retry. See Idempotent requests.
255"d9105228-4a08-46b1-8b91-42fed586d383"
Pins the request to a dated API version.
"2026-10-13"
Body
The purchase: the account it belongs to, what is bought, and the promo code applied. The same shape prices a purchase and pays for it.
The account the purchase belongs to, prefixed biz_.
"biz_xxxxxxxxxxxxxx"
What the buyer is purchasing. One entry charges that variant; several entries form a cart, which requires every variant to be compatible, belong to this account, and use the same currency. Mutually exclusive with plan_id and plan.
1 - 50 elementsThe variant purchased, described by its attributes instead of an id: the variant with exactly these attributes is used, and one is created when none exists. Mutually exclusive with plan_id and line_items. Creating a variant requires plan:create; creating or updating a product requires the corresponding product permission.
The variant purchased, prefixed plan_. It must belong to the account. Mutually exclusive with plan and line_items.
"plan_xxxxxxxxxxxxxx"
The promo code as the buyer typed it, matched within the account regardless of case and surrounding spaces, as checkout matches it. It must be valid for the variant. Send it or promo_code_id, not both; an empty or whitespace-only string counts as not sent. A code the account does not have, or one that is no longer active, is refused before anything is written, with the error code promo_invalid. A code this purchase cannot use, such as one with no uses left or one restricted to other variants, products or buyers, is refused with promo_invalid too, and the error's message says why.
"SHINE20"
An active promo code to apply, prefixed promo_. It must belong to the account and be valid for the variant. Send it or promo_code, not both. A code this purchase cannot use is refused with the error code promo_invalid, and the error's message says why.
"promo_xxxxxxxxxxxxxx"
The code an affiliate link carries, which is the affiliate's username. The affiliate is credited for this payment as on a checkout session. A code naming no one eligible to earn on the product is ignored, and the payment goes ahead. A promo code with its own affiliate takes precedence. No affiliate is credited on a variant without a product or on a purchase of several variants. At most 255 characters. Not supported with payment_method.
"priyaraman"
Minutes after authorization at which Whop captures the hold automatically unless it has been voided. Requires capture: false. Between 5 and 5760 (4 days).
5 <= x <= 576060
Whether to capture a card payment immediately. Defaults to true. Pass false to place an authorization hold that must be captured in full within five days via the capture endpoint, or automatically after auto_capture_after_minutes.
false
A confirmation token describing a payment method the buyer just supplied. Provide this instead of member_id and payment_method_id; the buyer is resolved from the token's billing email, or from email. The buyer may still have a step to complete — poll the payment's status for what to do next.
"ctok_xxxxxxxxxxxxxx"
The buyer's email, resolving or creating the user the payment belongs to. With confirmation_token it overrides the email the token carries, and is ignored when the token was created by a signed-in buyer; with payment_method it names a buyer the point of sale already knows, otherwise the sale belongs to a guest until a buyer is attached. Ignored with member_id.
"dana@shinetime.example"
The buyer's IPv4 or IPv6 address, used to assess the charge's risk and passed to the processor. Ignored unless a saved payment method is charged with off_session set to false.
"203.0.113.24"
The member to charge, prefixed mber_. Required with payment_method_id unless confirmation_token is provided.
"mber_xxxxxxxxxxxxxx"
Custom metadata to attach to the payment.
Whether the buyer is absent from your checkout and can't authenticate. Pass true when you charge the card without the buyer, such as a renewal on your own schedule. Pass false when the buyer is present, such as a one-click upsell right after checkout: the charge is processed as a customer-initiated card-on-file payment, and if the issuer asks the buyer to authenticate, the payment's status is requires_action with a next_action to send them to, after which they return to return_url. From API version 2026-10-07-1 it defaults to false when return_url is provided and to true otherwise; before that version it defaults to true. A saved Apple Pay, Google Pay or PayPal payment method is always charged with off_session true. Ignored unless member_id and payment_method_id are provided.
true
A payment method collected on the seller's device rather than described by a confirmation token. type names it and the member named after it carries what the device needs. Today only card_present (Tap to Pay): nothing is collected on this call, the payment is created first and the reader then collects against it with the client secret the status endpoint serves in next_action. Mutually exclusive with confirmation_token, member_id and payment_method_id.
The stored payment method to charge, prefixed payt_. It must belong to the member. Required unless confirmation_token is provided.
"payt_xxxxxxxxxxxxxx"
A payment quote from POST /payment_quotes, prefixed pq_. The payment charges exactly the quote: its purchase (its variants and quantities, or the plan it priced), which this body may then omit, its promo code, and its tax, the quote's tax_amount rather than a figure calculated now. Omit it, or send null, to have tax calculated when the payment is charged. The quote must belong to account_id. A purchase field you omit or send as null takes the quote's value; the buyer's email, the addresses and the payment method are this request's own, never the quote's. Whatever you do send must describe the quoted purchase: the same variants, quantities and promo code. A quote that priced plan takes only the same plan you sent to POST /payment_quotes (or omit the purchase to take the quoted one), never plan_id or line_items, and a quote that priced variants by id never takes plan. Unless the quote located no buyer (located_by is null), the address the payment carries (its shipping address, else its billing address) must put the buyer where the quote priced tax, by country, state and postal code; otherwise the payment is refused with 400 before the payment method is used. A quote located by IP address or by the country the buyer chose (located_by is ip_address or presentment_country) is a preview and cannot be paid. A quote is consumed by one payment: a declined payment keeps it and can be retried; a new payment needs a new quote. A quote cannot be charged by a processor that doesn't take quotes, such as a seller's own connected PayPal account; such a payment is refused before the payment method is used. A quote priced in a presentment_currency is charged in that currency at the quote's exchange_rate. A payment refused over its quote carries an error code. quote_expired: the quote has expired; quote again. quote_tax_unavailable: the quote could not price tax; quote again, or omit quote_id. quote_preview_only: the quote was located by IP address or by the country the buyer chose; quote again with the buyer's address. quote_in_use (409): another payment holds the quote. quote_mismatch: the purchase or the buyer's address is not the one quoted. quote_rate_expired: the exchange rate the quote was priced at has moved too far to charge; quote again. payment_method_currency_unsupported: the payment method cannot pay in the quote's currency; use another method, or quote again in another currency. quote_processor_unsupported: the payment would be processed by a processor that doesn't take quotes, such as a seller's own connected PayPal account; use another method, or omit quote_id to have tax calculated when the payment is charged.
"pq_xxxxxxxxxxxxxxx"
Where the buyer continues after completing an off-site step such as 3D Secure. An absolute https URL without credentials, at most 2,048 characters. Required when a saved payment method is charged with off_session false; otherwise ignored unless confirmation_token is provided.
"https://shinetime.example/checkout/done"
Where physical goods ship, returned on the payment as shipping_address. Only the keys you supply are kept; omit it for digital goods.
Overrides the text on the buyer's card statement for this payment only. Takes precedence over the product's and account's custom descriptors, and changes neither. Must start with WHOP* unless the business processes as the merchant of record. For businesses processing as the merchant of record, omit the WHOP* prefix; the descriptor appears as provided. Must be 5-22 characters, contain at least one letter, and use only Latin letters, numbers, spaces, underscores, hyphens, or asterisks.
"WHOP*SHINETIME"
Response
payment created from a stored payment method
The account that received the payment, prefixed biz_.
"biz_xxxxxxxxxxxxxx"
What the account keeps: the total less Whop's fees.
True when Whop refunded the payment automatically, for example on a dispute alert.
false
The billing address the buyer entered, or null.
Why the charge was created: a first purchase, a renewal, a one-time payment, or a manual charge.
subscription_create, subscription_cycle, subscription_update, one_time, manual, subscription "subscription_create"
The checkout configuration the buyer paid through, prefixed ch_, or null.
null
The credential a buyer's surface presents to poll this payment and set its return URL. Only on payments created from a confirmation token, and always null in list responses — retrieve the payment for it.
"pay_xxxxxxxxxxxxxx_secret_vdefault_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
When the payment was created, as an ISO 8601 timestamp.
"2026-01-01T12:00:00.000Z"
The currency the payment settles in, lowercase ISO 4217. Every money field below is stated in it unless it says otherwise.
usd, sgd, inr, aud, brl, cad, dkk, eur, nok, gbp, sek, chf, hkd, huf, jpy, mxn, myr, pln, czk, nzd, aed, eth, ape, cop, ron, thb, bgn, idr, dop, php, try, krw, twd, vnd, pkr, clp, uyu, ars, zar, dzd, tnd, mad, kes, kwd, jod, all, xcd, amd, bsd, bhd, bob, bam, khr, crc, xof, egp, etb, gmd, ghs, gtq, gyd, ils, jmd, mop, mga, mur, mdl, mnt, nad, ngn, mkd, omr, pyg, pen, qar, rwf, sar, rsd, lkr, tzs, ttd, uzs, rub, btc, cny, usdt, kzt, awg, whop_usd, xau "usd"
The buyer's email address. Null without member:email:read on the account or when the buyer has no assigned email.
"marcus@shinetime.example"
The phone number the buyer gave at checkout, when one was collected.
"+xxxxxxxxxxx"
The normalized decline reason of the most recent failed attempt, or null.
insufficient_funds, lost_card, stolen_card, expired_card, suspected_fraud, invalid_card_number, invalid_cvc, invalid_cvc_or_expiration, incorrect_pin, authentication_required, card_not_supported, currency_not_supported, duplicate_transaction, generic_decline, invalid_account, invalid_amount, processing_error, restricted_card, card_velocity_exceeded, contact_issuer, card_declined_by_issuer, bank_declined, regulatory_blocked, transaction_not_permitted, transaction_stopped, card_type_not_supported, issuer_not_found, closed_account, issuer_unavailable, invalid_zip, invalid_expiry_month, invalid_expiry_year, invalid_expiry, invalid_transaction, cannot_authorize, pin_required, pin_try_exceeded, provider_declined, high_risk, test_mode_decline, merchant_blacklist, reenter_transaction, invalid_pin, pin_required_as, withdrawal_count_limit_exceeded, invalid_country, issuer_error, invalid_card_holder_name, no_accounts, transaction_cancelled, three_d_secure_success, three_d_secure_canceled, three_d_secure_invalid_card_number, three_d_secure_generic_error, three_d_secure_timeout, three_d_secure_failed, three_d_secure_card_not_enrolled, three_d_secure_fraud, three_d_secure_too_many_attempts, three_d_secure_rejected_by_bank, three_d_secure_reported_lost_or_stolen, blocked_by_cardholder, test_mode_test_card, try_again_later, transaction_not_allowed, bank_insufficient_funds, bank_account_not_found, bank_account_closed, bank_account_frozen, bank_invalid_routing_number, bank_non_transaction_account, bank_authorization_revoked, bank_payment_stopped, bank_not_authorized, bank_account_holder_deceased, bank_duplicate, bank_amount_error, bank_regulatory_blocked, bank_details_invalid, bank_processing_error, bank_generic_decline, sepa_invalid_iban, sepa_no_mandate, sepa_mandate_data_invalid, sepa_disputed, sepa_refused_by_customer, sepa_generic_decline "insufficient_funds"
When an issuer warned that this payment will be disputed, or null.
null
Why the most recent attempt failed, in plain words, or null.
null
For installment methods, how many payments the charge splits into.
null
Payment ID, prefixed pay_.
"pay_xxxxxxxxxxxxxx"
When the most recent charge attempt ran, or null.
null
The buyer's member record on the account, prefixed mber_. Null without the member:basic:read permission.
"mber_xxxxxxxxxxxxxx"
The membership this payment is billed against, prefixed mem_. Null for one-off purchases or without the member:basic:read permission.
"mem_xxxxxxxxxxxxxx"
Your own key-value data attached when the payment was created.
True when funds are held until the order ships and no tracking number has been added yet. Null without the shipment:basic:read permission.
false
When the next automatic retry is scheduled, or null.
null
When the money was collected, or null while it has not been.
"2026-01-01T12:00:00.000Z"
The instrument shaped for display: a buyer-facing name, the standard icon set, and the card's brand, last four and issuer identification number when it was a card.
The stored payment method that was charged, prefixed payt_. Null when the method was not saved.
"payt_xxxxxxxxxxxxxx"
The kind of instrument used, for example card, apple_pay, klarna, or us_bank_account.
acss_debit, addi, affirm, afterpay_clearpay, alipay, alipayhk, alma, amazon_pay, apple, apple_pay, au_bank_transfer, au_becs_debit, bacs_debit, bancolombia, bancontact, bank_wire, billie, blik, boleto, bre_b, ca_bank_transfer, capchase_pay, card, card_present, card_installments_three, card_installments_six, card_installments_twelve, cashapp, claritypay, coinbase, crypto, custom, customer_balance, demo_pay, duitnow_qr, efecty, eps, eu_bank_transfer, fpx, flex_pay, gb_bank_transfer, gcash, giropay, google_pay, gopay, grabpay, id_bank_transfer, ideal, interac, kakao_pay, klarna, klarna_pay_now, konbini, kr_card, kr_market, kriya, kueski, link, mb_way, m_pesa, mercado_pago, mercado_pago_ar, mercado_pago_mx, mobilepay, modo, mondu, multibanco, naver_pay, nequi, netbanking, ng_bank, ng_bank_transfer, ng_card, ng_market, ng_ussd, ng_wallet, nupay, nz_bank_account, oney, oney_3x, oney_4x, opay, oxxo, p24, pago_efectivo, pse, pay_by_bank, payco, paynow, paypal, paypal_express, paypay, payto, pix, platform_balance, promptpay, qris, rapipago, rechnung, revolut_pay, samsung_pay, satispay, scalapay, sencillito, sepa_debit, sequra, servipag, sezzle, shop_pay, shopeepay, sofort, south_korea_market, spei, splitit, sunbit, swish, tabby, tamara, touch_n_go, twint, upi, us_bank_account, us_bank_transfer, venmo, verve, vipps, webpay, wechat_pay, whop_pay, yape, zip, coinflow, unknown "acss_debit"
How many charge attempts have failed on this payment.
0
The variant that was charged, prefixed plan_.
"plan_xxxxxxxxxxxxxx"
The account-facing total in the currency presented to the buyer, before conversion into the settlement currency. Excludes buyer fees.
The product the variant belongs to, prefixed prod_. Null for a variant with no product.
"prod_xxxxxxxxxxxxxx"
The promo code applied at checkout, prefixed promo_, or null.
null
The payment quote this payment charged, prefixed pq_: its purchase, promo code and tax_amount are the quote's. Null when the payment named no quote and tax was calculated at charge time.
null
Whop-hosted URL where the buyer can sign in and complete 3D Secure for an off-session charge the bank challenged — a subscription renewal or a saved-card payment. Null when recovery is unavailable, you lack member:basic:read, or in list responses. Retrieve the payment for it.
null
True when the payment is paid, not yet fully refunded, and its processor supports refunds.
false
How much has been refunded so far, as it settled — refunds convert at the rate in force when each one was issued, not the payment's original rate.
When the payment was refunded, or null.
null
True when the payment is open and Whop can attempt the charge again — see POST /payments/{id}/retry.
true
Whop's published risk index from 0 (lowest) to 100 (highest), including enforced decision floors. This is not a fraud probability. Null when no score is available.
null
Deprecated. Risk score explanations are no longer provided; always null. DEPRECATED: Risk score explanations are no longer provided. Always null.
null
When the portion not listed in holds posts to the account's available balance, at midnight UTC. The financial_activity.funds_available webhook's posted_at carries the same value when the settlement that clears it posts. Null until the payment is paid, and always null in list responses — retrieve the payment for it.
null
The shipment fulfilling this payment, prefixed ship_. Null when nothing ships or without the shipment:basic:read permission.
null
The shipping address for physical goods, or null.
The lifecycle state of the charge: open while collection is outstanding, paid once the money moved, pending while a settlement rail clears, void/uncollectible when it ended without collecting.
draft, open, authorized, paid, pending, uncollectible, unresolved, void "draft"
The dashboard's finer-grained reading of the payment, folding in refunds, disputes and Resolution Center cases.
succeeded, requires_capture, pending, failed, blocked, past_due, canceled, price_too_low, uncollectible, refunded, auto_refunded, partially_refunded, dispute_warning, dispute_needs_response, dispute_warning_needs_response, resolution_needs_response, dispute_under_review, dispute_warning_under_review, resolution_under_review, dispute_won, dispute_warning_closed, resolution_won, dispute_lost, dispute_closed, resolution_lost, drafted, incomplete, unresolved, open_dispute, open_resolution "succeeded"
The price before discounts, tax and fees.
The sales tax or VAT collected. Null when no tax applied.
Whether tax_amount was added on top of the price (exclusive) or was already inside it (inclusive).
exclusive, inclusive, unspecified, unable_to_collect "exclusive"
How much of the collected tax has been returned to the buyer so far. Zero when the payment carried no tax, or when nothing has been refunded.
True when the buyer completed 3D Secure for this payment.
false
The account-facing total: the price after discounts, plus any tax added on top. Excludes buyer fees, which the buyer pays above this amount — so this is not necessarily what the buyer's statement shows.
When the payment last changed, as an ISO 8601 timestamp.
"2026-01-01T12:00:00.000Z"
The total converted to USD at the time of the charge, for reporting across currencies. Excludes the adaptive pricing FX markup, which the account does not keep.
The buyer. Null when the payment belongs to a company buyer rather than a user.
The Address Verification Service (AVS), cardholder name, and Card Verification Value (CVV/CVC) results, or null when the processor returned none.
True when the payment can be voided or canceled. The request is rejected if the payment is no longer eligible — see POST /payments/{id}/void.
false